Site Reliability Engineering
Log in history of users using SAL
Especially in larger companies, which also have multiple locations in different countries, it is often necessary to grant different employees the same permissions for different levels of organisation, such as accounting circles. In order to make maintenance and maintenance of the system easy in such a situation, it is useful to set the inheritance principle for SAP permissions. How does SAP Permissions Inheritance work? An inheritance is always about a master object passing certain properties to a derived (sub) object. Therefore, these properties do not need to be maintained several times. Also, changes to the master object are passed directly to the derived objects. This allows easier maintenance and drastically minimises the error rate. In the case of SAP Permission Inheritance, the required permissions are bundled in a Upper or Master role. Only the organisational levels have to be maintained in the roles derived from them. The permissions are automatically pulled from the master role. Create Inheritance for SAP Permissions The following shows how to create and use inheritances for SAP permissions. This requires only two steps: Creating a master role and defining derived roles. Step 1: Create a master role Inheritance always requires a parent role, because all properties are inherited from it. If this role, in which all shared permissions are bundled, is missing, the first step is to create this master role. To do this, open the PFCG transaction and enter the desired name of the master role in the Name field. It is possible to identify master and derived roles by using naming conventions. The "Single Role" button will then be used to create the desired role. In the following example I create the master role "findepartment_r".
I recommend that you schedule the background job PFCG_TIME_DEPENDENCY with the report RHAUTUPD_NEW. Scheduling the RHAUTUPD_NEW report with two variants has proven to be a best practice: Once a day before users log on for the first time (e.g. midnight or very early in the morning). This way the users are synchronized once a day. Once a month (or even once a week) with the option "Perform cleanup", so that obsolete profiles and user mappings are regularly cleaned up. Also handy: If the naming conventions of your roles allow it, you can also align the report according to different time zones. For example, I have a customer who runs the user synchronization for his users in the USA and Asia at different times, so that the daily business of the respective users is not disturbed.
(De-)installation and update/upgrade of SAP AddOns
In the initial screen, you can first use the global settings to specify whether changes should be allowed in general. Furthermore, you can define specifically for the software components and namespaces of the Repository objects whether they can be changed at all, or whether changeability should only be possible to a limited extent.
If a company chooses to tackle the area of e-learning itself and also to create the content for it itself, there is a certain challenge. The most obvious point here is that the above-mentioned initial effort is borne by the company. This means that employees spend their time creating videos, preparing presentations and/or creating questionnaires. This not to be underestimated effort must of course be borne by the company initially. On the other hand, a self-created e-learning offer offers the possibility to design it completely by itself and tailor it to the company's own needs. In addition, a company can decide whether it will use the e-learning offer itself only for its own employees (for internal training purposes) or whether it will also present the offer externally. This can be used, for example, for advertising purposes, as a know-how presentation or as a further source of income. Use the external sources: This is a very pleasant way for the company to improve the internal processes through ELearning. By acquiring external e-learning content, the company can purchase valuable know-how for comparatively low money. This know-how is in most cases already well prepared, that this can only be passed on to the employees and they can then independently acquire new knowledge or consolidate already known topics.
The "Shortcut for SAP Systems" tool is ideal for doing many tasks in the SAP basis more easily and quickly.
This is because the user synchronization checks which roles are assigned to a user and then assigns the current, matching profile.
At a glance, the decision-makers see that one of their employees has a critical role and can examine it carefully.